Webhooks and Authentication
Draft
This page is a stub. It captures the intended structure of the BoxNCase Platform documentation; the details are being written as the platform ships. Questions: [email protected].
Authentication
- Platform services are installed as apps in each stack with the minimum permissions they need.
- App tokens are issued per stack and rotated; they are never shared across vendors.
- Humans use dashboard accounts; see Authentication for token flows.
Webhooks the platform subscribes to
| Event | Purpose |
|---|---|
PRODUCT_UPDATED, PRODUCT_VARIANT_UPDATED | Marketplace listing sync |
PRODUCT_VARIANT_STOCK_UPDATED | Marketplace stock sync |
ORDER_CREATED, ORDER_UPDATED, ORDER_FULFILLED | Order mirroring and settlement |
FULFILLMENT_TRACKING_NUMBER_UPDATED | Tracking mirrored to the marketplace |
See Webhooks for payloads and delivery semantics.
Outline (to be written)
- Verifying platform-originated requests (signature headers)
- Sync webhooks used for pricing and shipping decisions
- Retry and dead-letter behaviour